Merge pull request #39144 from github/repo-sync · github/docs@0bace78 · GitHub | Latest TMZ Celebrity News & Gossip | Watch TMZ Live
Skip to content

Commit 0bace78

Browse files
docs-botdocs-bot
authored
Merge pull request #39144 from github/repo-sync
Repo sync
2 parents abd84c0 + 83ab117 commit 0bace78

File tree

6 files changed

+292
-3
lines changed

6 files changed

+292
-3
lines changed

‎content/contributing/style-guide-and-content-model/style-guide.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -810,6 +810,19 @@ If multiple roles or products apply to a permission statement or product callout
810810
811811
You can use inline links to provide more information about a role or product. The linked text must match the link destination so that it is clear where following the link will lead to.
812812
813+
## Parenthetical dashes
814+
815+
We use em dashes for parenthetical statements in normal body text. This doesn’t apply to text within code blocks.
816+
817+
Examples:
818+
819+
* ✅ Correct: "The cat—which sat on a branch—smiled with a broad grin." (em dash without spaces)
820+
* ❌ Incorrect: "The cat — which sat on a branch — smiled with a broad grin." (em dash with spaces)
821+
* ❌ Incorrect: "The cat–which sat on a branch–smiled with a broad grin." (en dash without spaces)
822+
* ❌ Incorrect: "The cat – which sat on a branch – smiled with a broad grin." (en dash with spaces)
823+
* ❌ Incorrect: "The cat-which sat on a branch-smiled with a broad grin." (hyphen without spaces)
824+
* ❌ Incorrect: "The cat - which sat on a branch - smiled with a broad grin." (hyphen with spaces)
825+
813826
## Placeholders
814827
815828
Style any placeholder text in all caps. If a placeholder is multiple words, connect the words with dashes (kebab-case). If you use a placeholder, explain what someone might replace it with. This helps people modify examples to fit their needs and helps identify placeholders for people who use assistive technology.

‎content/copilot/tutorials/copilot-chat-cookbook/security-analysis/index.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ versions:
99
topics:
1010
- Copilot
1111
children:
12+
- /securing-your-repository
13+
- /managing-dependency-updates
1214
- /finding-existing-vulnerabilities-in-code
1315
---
1416

‎content/copilot/tutorials/copilot-chat-cookbook/security-analysis/managing-dependency-updates.md

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
---
2+
title: Managing dependency updates
3+
shortTitle: Manage dependency updates
4+
intro: '{% data variables.copilot.copilot_chat_short %} can help you get set up with {% data variables.product.prodname_dependabot %} to streamline dependency updates.'
5+
versions:
6+
feature: copilot
7+
category:
8+
- 'Security analysis'
9+
complexity:
10+
- Simple
11+
octicon: code
12+
topics:
13+
- Copilot
14+
---
15+
16+
## Automate dependency updates
17+
18+
### Example scenario
19+
20+
Let's say your project depends on numerous libraries and packages. Vulnerable or outdated dependencies create security risks that can affect your project and others that rely on it.
21+
22+
{% data variables.copilot.copilot_chat_short %} can help you get set up with {% data variables.product.prodname_dependabot %} security and version updates, so that your dependencies always remain on the most secure, and up-to-date versions. See [AUTOTITLE](/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates) and [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates).
23+
24+
Before you begin, ensure that {% data variables.product.prodname_dependabot %} is fully enabled under your repository's "Settings."
25+
1. Under your "Code security" settings, ensure **{% data variables.product.prodname_dependabot_alerts %}** and **{% data variables.product.prodname_dependabot_security_updates %}** are both set to "Enabled."
26+
1. Create and commit an empty `.github/dependabot.yml` file to the repository.
27+
28+
### Example prompt
29+
30+
Make sure your repository is attached to the prompt for context.
31+
32+
`Analyze the codebase and project structure of this repository. Detect all package managers and package ecosystems in use, including their respective locations (e.g., npm, yarn, pip, maven, gradle, composer, github-actions, etc.).`
33+
34+
`For each detected ecosystem, create a configuration entry in a single, top-level .github/dependabot.yml file that enables security and version updates on a reasonable schedule. Use the recommended best practices for each ecosystem. Clearly specify the directory for each ecosystem detected. If multiple ecosystems or multiple directories are present, include them all in the configuration.`
35+
36+
`In the output, include any notes on the configuration or best practices, as well as next steps that include how to commit the dependabot.yml file to the repository via the GitHub web browser and how to check that Dependabot version updates and Dependabot security updates are enabled.`
37+
38+
### Example output
39+
40+
{% data variables.copilot.copilot_chat_short %} analyzes your repository and writes the contents of the `dependabot.yml` configuration file for you, which tells {% data variables.product.prodname_dependabot %} which dependencies it needs to scan for.
41+
42+
```yaml
43+
version: 2
44+
updates:
45+
# Python (pip)
46+
- package-ecosystem: "pip"
47+
directory: "/" # Location of requirements.txt
48+
schedule:
49+
interval: "weekly" # Weekly updates are a good balance for libraries
50+
day: "sunday"
51+
time: "06:00"
52+
timezone: "UTC"
53+
open-pull-requests-limit: 5
54+
allow:
55+
- dependency-type: "all"
56+
commit-message:
57+
prefix: "pip"
58+
labels:
59+
- "dependencies"
60+
- "python"
61+
ignore:
62+
- dependency-name: "pip" # Ignore pip self-updates
63+
64+
# GitHub Actions
65+
- package-ecosystem: "github-actions"
66+
directory: "/" # Looks for workflow files under .github/workflows/
67+
schedule:
68+
interval: "weekly"
69+
day: "sunday"
70+
time: "06:00"
71+
timezone: "UTC"
72+
open-pull-requests-limit: 5
73+
commit-message:
74+
prefix: "actions"
75+
labels:
76+
- "dependencies"
77+
- "github-actions"
78+
```
79+
80+
Once you've committed the `dependabot.yml` file to your repository, {% data variables.product.prodname_dependabot %} will begin to open pull requests against your repository, whenever a vulnerable or outdated dependency is detected.
81+
82+
## Customize dependency management
83+
84+
### Example scenario
85+
86+
### Example scenario
87+
88+
Let's say your team has been using the basic {% data variables.product.prodname_dependabot %} configuration for a few months, and you're getting lots of dependency update pull requests. However, you're finding that:
89+
90+
* Pull requests are sitting un-reviewed because no one is automatically assigned.
91+
* You want pull requests to be automatically added to your team's project board via a label.
92+
* Your CI is getting overwhelmed with too many concurrent dependency pull requests.
93+
* You're getting updates for development dependencies that don't affect production.
94+
95+
You want to customize your {% data variables.product.prodname_dependabot %} configuration to better fit your team's workflow, such as automatically assigning pull requests to the right team members, adding labels to add pull requests to project board, limiting the number of open pull requests, and focusing only on production dependencies.
96+
97+
{% data variables.copilot.copilot_chat_short %} can write an updated `dependabot.yml` that better suits your team's needs.
98+
99+
### Example prompt
100+
101+
`I want to customize my pull requests for Dependabot security and version updates, so that:`
102+
103+
`* Pull requests are automatically assigned to the team "octocat-reviewers."`
104+
105+
`* The label "security-management" is automatically added to every pull request.`
106+
107+
`* The number of open Dependabot PRs is limited.`
108+
109+
`* Development dependencies are ignored.`
110+
111+
`Draft an update to the dependabot.yml file in my repository that specifies these customization options.`
112+
113+
> [!TIP]
114+
> * There are many customization options to explore. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-security-updates/customizing-dependabot-security-prs) and [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/customizing-dependabot-prs).
115+
> * You can specify different customizations per package ecosystem.
116+
117+
### Example output
118+
119+
```yaml
120+
version: 2
121+
updates:
122+
# Python (pip)
123+
- package-ecosystem: "pip"
124+
directory: "/"
125+
schedule:
126+
interval: "weekly"
127+
day: "sunday"
128+
time: "06:00"
129+
timezone: "UTC"
130+
open-pull-requests-limit: 5
131+
allow:
132+
- dependency-type: "production" # Ignore development dependencies
133+
assignees:
134+
- "octocat-reviewers" # Assign PRs to the team
135+
labels:
136+
- "dependencies"
137+
- "security-management" # Custom label for all PRs
138+
- "python"
139+
commit-message:
140+
prefix: "pip"
141+
ignore:
142+
- dependency-name: "pip"
143+
```

‎content/copilot/tutorials/copilot-chat-cookbook/security-analysis/securing-your-repository.md

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
---
2+
title: Securing your repository
3+
shortTitle: Secure your repository
4+
intro: '{% data variables.copilot.copilot_chat_short %} can help you to secure your repository and your code.'
5+
versions:
6+
feature: copilot
7+
category:
8+
- 'Security analysis'
9+
complexity:
10+
- Simple
11+
octicon: code
12+
topics:
13+
- Copilot
14+
---
15+
16+
## Configure essential security features
17+
18+
### Example scenario
19+
20+
Let's say you recently created a repository for a new web application, you want to secure it and you don't know where to start.
21+
22+
{% data variables.copilot.copilot_chat_short %} can walk you through configuring the most essential security features to ensure your repository remains secure.
23+
24+
### Example prompt
25+
26+
`Provide step-by-step instructions on how to enable the following essential security features in my GitHub repository:`
27+
28+
`* Secret scanning`
29+
30+
`* Push protection`
31+
32+
`* Dependabot alerts`
33+
34+
`* Dependabot security updates`
35+
36+
`* Branch protection rules, including enforced code reviews before merging`
37+
38+
`Explain why each feature is important and how it helps secure my repository.`
39+
40+
### Example response
41+
42+
{% data variables.copilot.copilot_chat_short %} provides information on each security feature and explains how to enable it.
43+
44+
```markdown
45+
Why it's important:
46+
47+
Secret scanning automatically detects accidentally committed secrets (API keys, credentials, etc.) in your repository.
48+
49+
How it helps:
50+
51+
Leaked secrets can allow attackers to access systems, steal data, or cause other harm. Early detection prevents misuse.
52+
53+
How to Enable:
54+
55+
1. Go to your repository on {% data variables.product.github %}.
56+
1. Click on Settings.
57+
1. In the left sidebar, click Code security.
58+
1. Scroll to Secret scanning.
59+
1. Ensure "Secret scanning" and "Push protection" are both enabled.
60+
1. If not, click Enable.
61+
```
62+
63+
## Encourage secure contributions and best practices with a security policy
64+
65+
### Example scenario
66+
67+
Let's say you want to share your project publicly, and want to set out a clear security policy to guide users on how to safely report vulnerabilities found in your repository.
68+
69+
{% data variables.copilot.copilot_chat_short %} can write a security policy for your repository.
70+
71+
### Example prompt
72+
73+
`Write a GitHub security policy (SECURITY.md) for my repository. The policy should include:`
74+
75+
`* A clear description of how users can report security vulnerabilities.`
76+
77+
`* A response timeline for security issues.`
78+
79+
`* Guidelines for responsible disclosure.`
80+
81+
`* Supported versions of the software.`
82+
83+
`Format it as a well-structured Markdown document.`
84+
85+
### Example output
86+
87+
{% data variables.copilot.copilot_chat_short %} produces a `SECURITY.md` file that you can commit to your repository.
88+
89+
```markdown
90+
# Security Policy
91+
92+
Thank you for helping to keep this project and its users secure! This document outlines the security policy and responsible disclosure guidelines for this repository.
93+
94+
## Reporting a Vulnerability
95+
96+
If you discover a security vulnerability, please report it by emailing **security@yourdomain.com** or by using the GitHub [security advisories](https://github.com/octocat/octocat-repo/security/advisories) feature.
97+
**Do not** report security vulnerabilities via public GitHub issues or pull requests.
98+
99+
When reporting a vulnerability, please include as much information as possible to help us understand and reproduce the issue:
100+
- A clear description of the vulnerability.
101+
- Steps to reproduce the issue.
102+
- Any relevant logs, screenshots, or proof-of-concept code.
103+
- Your assessment of the potential impact.
104+
105+
## Response Timeline
106+
107+
We take security issues seriously and will respond according to the following guidelines:
108+
- **Acknowledgment:** We will acknowledge receipt of your report within **3 business days**.
109+
- **Investigation:** We will investigate and assess the report as quickly as possible, usually within **7 business days**.
110+
- **Resolution:** Once a fix is identified, we will work to release a security update promptly. We will coordinate with you as needed, especially if you are the reporter.
111+
- **Disclosure:** We will notify the community of the vulnerability and fix via a GitHub security advisory, and credit the reporter as appropriate.
112+
113+
## Responsible Disclosure Guidelines
114+
115+
To protect users of this project, we ask that you:
116+
- Avoid public disclosure of the vulnerability until it has been investigated and patched.
117+
- Allow us a reasonable amount of time to resolve the issue before any public disclosure.
118+
- Provide relevant details privately (see "Reporting a Vulnerability" above).
119+
- Act in good faith and avoid exploiting the vulnerability beyond what is necessary for your report.
120+
121+
We are committed to working with security researchers and the community to ensure a safe and secure software ecosystem.
122+
```
123+
124+
## Further reading
125+
126+
{% data reusables.copilot.example-prompts.further-reading-items %}

‎content/rest/orgs/attestations.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
2-
title: TODOCS
3-
shortTitle: TODOCS
4-
intro: TODOCS
2+
title: REST API endpoints for artifact attestations
3+
shortTitle: Artifact attestations
4+
intro: Use the REST API to interact with artifact attestations.
55
versions: # DO NOT MANUALLY EDIT. CHANGES WILL BE OVERWRITTEN BY A 🤖
66
fpt: '*'
77
ghec: '*'

‎data/reusables/gated-features/security-features-basic.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
The availability of security features mentioned in this article varies:
2+
3+
* {% data variables.product.prodname_dependabot %} is available for all repository types.
4+
* {% data variables.product.prodname_secret_scanning_caps %} and push protection are available for public repositories, or private repositories with [{% data variables.product.prodname_GH_secret_protection %}](/get-started/learning-about-github/about-github-advanced-security) enabled.
5+
* Branch protection rules are available for public repositories, or private repositories on a {% data variables.product.prodname_pro %}, {% data variables.product.prodname_team %}, {% data variables.product.prodname_ghe_cloud %}, and {% data variables.product.prodname_ghe_server %} plan.

0 commit comments

Comments
 (0)

TMZ Celebrity News – Breaking Stories, Videos & Gossip

Looking for the latest TMZ celebrity news? You've come to the right place. From shocking Hollywood scandals to exclusive videos, TMZ delivers it all in real time.

Whether it’s a red carpet slip-up, a viral paparazzi moment, or a legal drama involving your favorite stars, TMZ news is always first to break the story. Stay in the loop with daily updates, insider tips, and jaw-dropping photos.

🎥 Watch TMZ Live

TMZ Live brings you daily celebrity news and interviews straight from the TMZ newsroom. Don’t miss a beat—watch now and see what’s trending in Hollywood.